E4/E5 minimal-audit manifest: registered design (ADR 0004, pre-lock)

[daphnehanse11]

Workstream A's remaining pre-lock artifact for #230 (§12.2), instantiating ADR 0004 (#224) at the first-lock scope (§9.1: SIPP-internal employer attachment only). Registered design — the sample is not drawn until the referee round fills the §6.1 numeric slots; the draw seed (20260717) and every design decision that must precede labels are registered now.

Highlights:

• The assignment under audit is named precisely: Census's dependent-interview EJB job-ID attachment as consumed by the reader — not a trained matcher — with truth hand-adjudicable from public-use fields (IDs masked from coders).
• The frame is the Cross-wave job-ID consistency check: PASS (pre-lock artifact for #230 §6) #235 population (384,747 within-wave job-holdings; 10,828 at the seam), the two ADR arms map to stay-pairs (precision) and separations (recall over the re-key class), and Cross-wave job-ID consistency check: PASS (pre-lock artifact for #230 §6) #235's frozen signature rates serve as the recall-arm prevalence prior.
• Candidate-generation recall = 1 by construction (within-person, all slots visible) — registered as structural, collapsing the ADR's two recall notions for this scope.
• REFEREE slots for P_floor/P_design/α/power/multiplicity with a worked binomial example (0.95/0.99/0.05/0.80 → n=124, c=122 per stratum, pre-clustering/pre-inflation; four arm-(a) strata ≈ 550 adjudications — feasible for a two-coder panel).
• Indeterminate handling registered before labels (conservative-against-the-assignment, with partial-identification bounds reported), plus calibration cases, blinded repeats, and the reference-label-error sensitivity bound.
• Two leakage freezes: the Cross-wave job-ID consistency check: PASS (pre-lock artifact for #230 §6) #235 signature parameters, and a ban on audit-label backflow into readers/imputation/hazards.

With this, both of Workstream A's §12.2 pre-lock artifacts are delivered (#235 the cross-wave check, this the audit manifest); the remaining pre-lock items are Workstream B's E2 sex×age floor build and the v1 promotion of the draft floors.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
social-security-model	Ready	Preview, Comment	Jul 17, 2026 1:26pm

[vahid-ahmadi]

The parts of this I'd keep verbatim: the indeterminate disposition registered pre-label with partial-identification bounds, the two leakage freezes, candidate-recall=1 registered as structural rather than measured, and dissolving the dual-frame overlap by choosing job-pair as the unit. That last one is a clean resolution of ADR §2.1's combined-inclusion requirement.

Main concerns below.

1. E5 isn't audited by this design

The manifest is titled E4/E5, but the audit unit is the adjacent-month job-pair only. ADR 0004 §4's E5 row says a per-month pass alone cannot certify a run because error compounds with length, and requires auditing the full multi-window run label including false-continuation and false-break errors. There's no run-level arm, no run-level floor, and no composition rule from pair precision to run precision.

A pass here can't license E5. Either retitle to E4-only, or add the run arm.

2. Two of the six "referee slots" are design freedom, not numerics

"Multiplicity rule" and "recall: gates or reported-with-bound" aren't numbers. The second is the load-bearing one: it leaves open whether the recall arm gates anything. A referee could, after arm-(b) numbers land, settle on "reported-with-bound" and neutralize the arm that targets #235's re-key failure mode.

The sequence does place the decision before the draw, which helps. But nothing forbids revisiting it, and ADR §1.2 wants this settled as an explicit C3 decision rather than an after-the-fact response to results. Suggest promoting both to registered-now, or adding an explicit no-revisit clause.

Relatedly: "REFEREE (recommended: intersection-union...)" embeds the design's own preferred answer inside a slot it claims to defer. Either register it or leave it open.

3. The power calculation doesn't apply to the stated design

n=124/c=122 is the independent-Bernoulli simple-random case. The design is worker-clustered with an unspecified anticipated design effect and an assumed 10% indeterminate inflation ("until the calibration round measures them"), with no stated stratum allocation. So ≈550 adjudications is arithmetic on an inapplicable formula — the "round number without the applicable calculation" ADR §2.3 warns about.

The sharper problem: deff and inflation are both later-measured, so the realized target stays adjustable after the frame and calibration labels are seen.

Arm (b) has no target size at all ("powered for the registered recall-bound width or floor, per the same machinery"). The prevalence prior is already in hand (17.5% seam / 2.4% within-wave), so this is computable now.

4. Pooling is deferred past the frame counts

"Any pooling is published in the draw artifact before adjudication" is weaker than ADR §6.1 item 3, which puts pooling before the powered target is calculated. With a feasibility argument already on the record, post-hoc pooling is a live channel for shrinking exactly the seam strata that carry the risk.

Non-blocking

• Blinding is arm-deducible. Masking EJB IDs doesn't blind the condition: arm-(a) sheets by construction contain a month-m+1 near-duplicate across industry/occupation/class/size/earnings; arm-(b) sheets are separations. A coder reads the arm off the evidence, and the arm is the matcher outcome. Since the discriminating fields are the evidence, a mechanical mask is impossible — I'd state that arm-blinding is unattainable and rely on outcome-blinding plus coders external to the project. Also worth noting one owner builds the frame, strata, and sheets and runs the coder panel; no independent holder of the unmasking key.
• The worked example anchors. Two complete parameter vectors, conventional α/power, resulting n, and a feasibility verdict. "Illustrative only" doesn't undo that — the referee now has one anchor labelled feasible and no counterexample at, say, P_floor = 0.98. Suggest a grid across 0.90–0.99 with costs, or at minimum drop the feasibility sentence.
• Calibration/repeat thresholds have no consequence. 10% blinded repeats "measure continuing accuracy and agreement" but register no minimum and no action on failure.
• Seed pinning is thinner than it reads. Seed 20260717 is registered before the draw script exists, and the RNG, row ordering, and stratum allocation are all downstream of unfilled §4 slots. Suggest pinning seed + RNG + sorted-key ordering in the script, and committing to one draw.
• Frame provenance is prose. §3 signature parameters are correctly pinned to build_crosswave_jobid_check.py; the frame query is cited by issue number. Same treatment would be good.
• ADR 0004 is unratified (#224 still open), so every "per ADR 0004 §X" is a forward reference to a document whose numbering can move. Worth stating merge order.

Bottom line

Structurally strong and unusually careful about leakage. Item 1 (E5 scope) is the one that changes what this can certify; item 2 is what I'd want settled before the draw rather than after.